拒绝白名单脚本的内容安全策略

Question

我将youtube API域列入了CSP标头的白名单，但它仍然拒绝该脚本。

CSP报头

default-src 'self'; script-src 'self' https://youtube.com/iframe_api s.ytimg.com; style-src 'self' ; img-src 'self' https://i.ytimg.com; font-src 'self'; connect-src 'self'; media-src 'self'; object-src 'none' ; child-src 'none' ; frame-src https://wwww.youtube.com ; worker-src 'self' ; frame-ancestors 'none' ; form-action 'self' ; upgrade-insecure-requests; block-all-mixed-content; disown-opener; sandbox allow-scripts allow-same-origin; reflected-xss block; manifest-src 'self' ; referrer no-referrer;

错误

Refused to load the script 'https://www.youtube.com/iframe_api' because it violates the following Content Security Policy directive: "script-src 'self' https://youtube.com/iframe_api s.ytimg.com".

Answer 1

通过使用strict-dynamic和随机数解决了这个问题